Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2023 05:10
Static task
static1
Behavioral task
behavioral1
Sample
ekeng-mta.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ekeng-mta.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
mta.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
mta.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
mta.ps1
Resource
win7-20230831-en
General
-
Target
mta.ps1
-
Size
743B
-
MD5
d4567ca45aded54298f9ccf063ed89cf
-
SHA1
72ef210030f0f470433a6aacc66dfbe4cbfdad5c
-
SHA256
60416198c9b2105c9204638fd00e154e2f5c32ba45f5a8ae2671bae565c062e9
-
SHA512
e616e9711a76525a30063b226c1c11131c30199a5cdb6389b6867e8a626d49abfa43c549f83f068fe7dfbe99c62c124ff838e318807ad65e8cd5db318088331e
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
193.161.193.99:31507
ajmlxbvgoegjpkevdnz
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral6/memory/4192-19-0x0000021EA5FA0000-0x0000021EA5FB8000-memory.dmp asyncrat -
Blocklisted process makes network request 27 IoCs
flow pid Process 26 4192 powershell.exe 28 4192 powershell.exe 29 4192 powershell.exe 30 4192 powershell.exe 38 4192 powershell.exe 44 4192 powershell.exe 45 4192 powershell.exe 46 4192 powershell.exe 47 4192 powershell.exe 48 4192 powershell.exe 50 4192 powershell.exe 52 4192 powershell.exe 53 4192 powershell.exe 54 4192 powershell.exe 55 4192 powershell.exe 59 4192 powershell.exe 62 4192 powershell.exe 63 4192 powershell.exe 64 4192 powershell.exe 65 4192 powershell.exe 66 4192 powershell.exe 67 4192 powershell.exe 68 4192 powershell.exe 69 4192 powershell.exe 70 4192 powershell.exe 71 4192 powershell.exe 72 4192 powershell.exe -
Downloads MZ/PE file
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe 4192 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4192 powershell.exe Token: SeDebugPrivilege 4192 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4192 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\mta.ps11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4192
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82